1
00:00:05,680 --> 00:00:06,940
Good morning, Beth.

2
00:00:07,320 --> 00:00:15,740
I'm Pete Cooper, Director of the Aerospace Village, and on behalf of the team, welcome to the Aerospace Village at Virtual DEF CON 28.

3
00:00:16,300 --> 00:00:23,960
Not quite what we all thought was going to be the plan, but let's face it, 2020 is trying to throw as many curveballs at us as possible.

4
00:00:24,100 --> 00:00:36,100
So while we're all trying to stay safe and healthy, we've got an amazing three days of virtual content lined up for you, irrespective of you being completely new to this or whether you're a seasoned black badge holder.

5
00:00:36,580 --> 00:00:56,880
Aviation is really a cornerstone of the global infrastructure and economy, and while passenger safety is at an all-time high, the increasing adoption of connected and digitized technologies is exposing aircraft, airport satellites, and the interdependent aerospace ecosystem to new types of risks and threats.

6
00:00:57,240 --> 00:01:12,280
And the consequences of a cyber security failure in a ground, air, or space-based system can impact human life, public safety, and even a crisis of confidence in the trustworthiness of air travel, which could undermine economic and national security.

7
00:01:12,480 --> 00:01:22,880
And as those traditional domains of aviation, safety, and security increasingly overlap, the more we can collaborate to enable stakeholders ensures that we're going to be safer and sooner together.

8
00:01:23,740 --> 00:01:36,820
The Aerospace Village is a non-profit set up and led by a volunteer team of hackers, pilots, engineers, policy advisors, who come from both across the public and private sectors.

9
00:01:37,340 --> 00:01:38,700
And why have we done this?

10
00:01:38,700 --> 00:01:54,300
Because we want to build an inclusive community around the topic of aerospace security, inspire you to get involved in one of the most amazing and growing areas of research that's out there, and promote and build aerospace cybersecurity knowledge and expertise.

11
00:01:55,040 --> 00:02:11,140
And through the Aerospace Village, the research community really is inviting everybody, be they industry leaders, researchers, academia, anybody interested in aviation, space security, safety, and resilience, to come in, understand, learn, and collaborate together.

12
00:02:11,380 --> 00:02:14,840
Because empathy and understanding is going to build common ground.

13
00:02:15,160 --> 00:02:21,380
Any sort of acts and words looking to increase division between the communities is going to undermine the efforts of us working together.

14
00:02:21,380 --> 00:02:30,760
So we're looking to welcome anybody and everybody who's wanting to improve aviation and space security, safety, and resilience through positive and productive collaboration.

15
00:02:31,660 --> 00:02:36,220
This isn't just a cool topic with a huge scope of cool tech.

16
00:02:36,640 --> 00:02:43,120
There's loads of research on the topic already, but it's a global topic and it's only getting bigger.

17
00:02:43,120 --> 00:02:48,420
And there's so much that is out there that is great to look at and explore.

18
00:02:48,600 --> 00:02:52,380
Last year, we had the Aviation Village at DEFCON.

19
00:02:52,660 --> 00:03:01,020
That was our first year, and we had great activity across airports, air traffic management, and aircraft, and great engagement.

20
00:03:01,480 --> 00:03:07,400
It's all massively interconnected and interdependent, and we started building out bridges across the community and industry.

21
00:03:07,800 --> 00:03:12,380
But since then, on the importance of such efforts, there's been some great progress.

22
00:03:12,400 --> 00:03:15,080
For example, international initiatives.

23
00:03:15,260 --> 00:03:30,800
The UN body for aviation, which is ICAO, with 193 member states, published late last year their first cyber security strategy for aviation, which specifically called out that states should give adequate protection to good faith researchers.

24
00:03:31,280 --> 00:03:37,280
And that's more and more recognition that such research like this is a positive thing, and it needs to be encouraged as well as protected.

25
00:03:38,120 --> 00:03:40,440
And additionally, there's also industry initiatives.

26
00:03:40,440 --> 00:03:49,180
For example, Boeing standing up an industry cyber technical council that actually incorporates the research and hacking community working with the team there.

27
00:03:49,860 --> 00:03:53,200
So this year, we've evolved into the Aerospace Village.

28
00:03:53,440 --> 00:03:59,060
Aviation is critically dependent on space, and the sector is really the aerospace sector.

29
00:03:59,060 --> 00:04:04,080
So yeah, we rolled into space, and we've now got a security community that's stretching from Earth into orbit.

30
00:04:04,240 --> 00:04:10,820
And a big part of that effort this year is to hack that CTF, which is pretty much the coolest CTF that isn't on the planet.

31
00:04:11,240 --> 00:04:13,020
And more of that later.

32
00:04:13,920 --> 00:04:20,680
It's amazing the support that we've got this year to help put on an amazing event for you over the next three days.

33
00:04:20,680 --> 00:04:39,860
And that support stretches from the USAF, DDS, CESA, Boeing, the American Institute of Aeronautics and Astronautics, both the aviation and space ISACs, TALIS, Capital Tech University, California Polytechnic, Pentas Partners, I'm the Cavalry, Rapid Seven,

34
00:04:39,860 --> 00:04:42,960
and even astronaut Pam Melroy is here, and more.

35
00:04:43,160 --> 00:04:51,640
All looking to try and give you a great experience and learn as much and play with as much as you want to over the next three days.

36
00:04:51,880 --> 00:05:00,860
We've got everything from topics on aircraft, airports, air traffic management, so air traffic control, aircraft, and space.

37
00:05:00,860 --> 00:05:03,340
Everything from satellites to ground stations.

38
00:05:03,680 --> 00:05:09,340
And we've got talks, panels, workshops, and CTFs, and everything from beginning to advanced.

39
00:05:09,480 --> 00:05:23,960
So please find our website at aerospacevillage.org, which has got the schedule and more content about what's on and what we're doing both now for DEF CON and as we're going forwards.

40
00:05:23,980 --> 00:05:28,380
And subscribe to us on YouTube and follow us on Twitter at Secure Aerospace.

41
00:05:28,760 --> 00:05:34,460
And finally, to really pull together and drive this amazing event, it takes an amazing team.

42
00:05:34,740 --> 00:05:36,560
And it's an honor to be a part of that amazing team.

43
00:05:36,560 --> 00:05:41,780
So when you're pleased floating around the virtual village, look out for the village leads and those team members.

44
00:05:41,780 --> 00:05:42,600
Say hi and thanks.

45
00:05:42,600 --> 00:05:46,200
They are the most awesome group of people that pull this together.

46
00:05:48,320 --> 00:05:54,460
So next up are two guest speakers that are going to help us open up the Aerospace Village this year.

47
00:05:54,500 --> 00:06:04,320
Partnerships are going to be really important to help build out this community and build trust between the hacking and researching community and industry and government.

48
00:06:04,320 --> 00:06:06,680
So it's great to have them here speaking at the opening.

49
00:06:06,680 --> 00:06:12,760
So the first is CISA Director Chris Krebs and this is the conversation that I had with him.

50
00:06:12,760 --> 00:06:13,620
Thank you.

51
00:06:13,920 --> 00:06:23,300
So welcome everybody to the Aerospace Village and I'm honored to have Director CISA Chris Krebs with us to help with the opening.

52
00:06:23,300 --> 00:06:25,240
So good morning Chris.

53
00:06:25,240 --> 00:06:26,460
Hey Pete, thanks for having me.

54
00:06:26,460 --> 00:06:32,140
Good to be here with you and the Aerospace Village, formerly the Aviation Village.

55
00:06:32,220 --> 00:06:33,220
It's a journey.

56
00:06:33,220 --> 00:06:34,340
It always is.

57
00:06:34,860 --> 00:06:38,920
So you came to the Aviation Village last year.

58
00:06:38,920 --> 00:06:46,420
We've got the Aerospace Village this year and I know that you and the CISA team are working really, really hard on the aerospace sector.

59
00:06:46,980 --> 00:06:54,540
But what's unique do you think about the aerospace sector when it comes to some of the challenges that we're facing across the security perspective?

60
00:06:55,300 --> 00:07:04,860
Yeah, I think it's representative of almost everything else in the kind of almost the industrial or life safety space.

61
00:07:04,860 --> 00:07:15,280
Things that historically have not been connected or relied upon overly networked systems, IT systems that either touch the internet or have paths of entry.

62
00:07:15,460 --> 00:07:19,000
That's different than it was 10 plus years ago.

63
00:07:19,000 --> 00:07:31,160
You know, when a plane used to lose the contact with the earth, it also lost contact, generally speaking, with communications channels.

64
00:07:31,160 --> 00:07:42,660
So what we're seeing now though is due to various customer demands, other navigation requirements, that yeah, there are pathways into a plane.

65
00:07:43,080 --> 00:07:45,080
And frankly, what's at stake?

66
00:07:45,080 --> 00:07:47,620
And we're really truly talking about lives here.

67
00:07:47,620 --> 00:08:04,440
So, you know, when I look at both aviation but more broadly aerospace, it's not just about the things that are moving around in the air, it's the things that are going through the infrastructure itself.

68
00:08:04,640 --> 00:08:08,080
You know, look at what's happened here in the US over the last year or so.

69
00:08:08,080 --> 00:08:09,840
It's the establishment of Space Command.

70
00:08:09,840 --> 00:08:10,260
Why?

71
00:08:10,260 --> 00:08:16,420
It's because the space-based infrastructure is that critical to just day-to-day operations.

72
00:08:16,420 --> 00:08:32,140
When you talk about PNT, when you talk about satellite-based communications, it really is a incredibly critical slice of not just our infrastructure, but of frankly our economy.

73
00:08:33,360 --> 00:08:42,200
So do you think that the threat actors are different to the other sectors, or is this still the same sort of threat environment that we're looking at here?

74
00:08:43,100 --> 00:08:47,360
Well, I do think that there are a couple different things you got to think about with the threat actors.

75
00:08:47,360 --> 00:08:54,700
So yes, they're absolutely threat actors that are focusing in on this aerospace ecosystem.

76
00:08:54,700 --> 00:08:58,820
And not that it's been a steady state thing, I think it's increasing.

77
00:08:59,200 --> 00:09:05,860
They're understanding the ability and the capability, particularly when you talk about functional disruptions.

78
00:09:06,380 --> 00:09:11,700
The future of warfare is not necessarily going to be on the plains of Europe.

79
00:09:12,040 --> 00:09:19,740
The first strike capabilities that you would see launched against our infrastructure are things we need to be thinking about.

80
00:09:19,740 --> 00:09:27,240
And that's from an elections perspective, election infrastructure perspective, that's what I've been talking about now for years.

81
00:09:27,240 --> 00:09:36,180
What was so dramatic or significant about the 2016 interference with the US election was it was almost a Sputnik moment.

82
00:09:36,180 --> 00:09:43,940
Take us back to 1957, and the Russia, the Soviets at the time, put Sputnik into low Earth orbit.

83
00:09:44,060 --> 00:09:53,100
It wasn't that they got to space first, it was that they had an ICBM, they had this capability to overcome geographic distancing and reach out and touch us.

84
00:09:53,140 --> 00:09:55,860
Why was 2016 the same?

85
00:09:55,860 --> 00:10:01,620
It was because cyber could be used as that tool to reach out and touch us and destabilize democracy.

86
00:10:01,740 --> 00:10:17,320
I think the future, again, of conflict is going to be using these infrastructure aspects against us to undermine our confidence, undermine our ability, or undermine our willingness to do the things that need to be done.

87
00:10:18,080 --> 00:10:19,100
And thanks for that.

88
00:10:19,100 --> 00:10:26,860
And so it shows that really, that this is touching on pretty much all the themes about trust and resilience across all the other sectors as well.

89
00:10:26,880 --> 00:10:45,260
But for those that are sort of new into the aerospace sector, and we've got loads of researchers and hackers that are now really engaging on the topic, what's the key challenge for yourselves on trying to look at the safety and security aspects of it?

90
00:10:45,260 --> 00:10:46,760
Because it's a safety critical industry.

91
00:10:46,760 --> 00:10:50,500
So we've got the FAA and also CISA in the frame as well.

92
00:10:50,500 --> 00:11:01,980
Can you try and help explain to the audience out there is actually how does that balance work on working through safety and security with the different partners that are out there?

93
00:11:02,720 --> 00:11:05,620
So, oh, wow.

94
00:11:05,720 --> 00:11:09,880
So, you know, they're the technical aspects of it, actually getting access to the equipment.

95
00:11:09,880 --> 00:11:14,640
This is not kit you can typically just find out they're hanging on eBay.

96
00:11:14,900 --> 00:11:24,020
So there are some proprietary systems that you've got to be able to get access to and work in an environment that's trusted.

97
00:11:24,020 --> 00:11:25,720
I think that's the second aspect.

98
00:11:25,720 --> 00:11:29,260
Beyond the technical, it's the relationship piece and the trust.

99
00:11:29,260 --> 00:11:46,820
You know, this is, I think, that constant struggle, that constant tension between the research community and the owner operators or the vendors is how do you have an effective, a meaningful conversation about security and trust when you add life safety?

100
00:11:46,820 --> 00:11:50,040
Same things for the medical device community, too.

101
00:11:50,040 --> 00:11:56,500
You know, unfettered access into a piece of equipment that has life safety implications is not something to be toyed with.

102
00:11:56,500 --> 00:11:59,460
And you want to make sure that you've got open lines of communication.

103
00:11:59,460 --> 00:12:08,660
You're not just dropping a ball onto the open market without giving the folks that are maintaining those systems the appropriate time to control or to implement.

104
00:12:08,660 --> 00:12:20,680
But that also, you know, when you talk about these proprietary systems, there are some DCMA and other issues that really restrict the ability or the access.

105
00:12:20,680 --> 00:12:28,920
So we have looked over the last several years to help really foster those conversations to bring the security researcher community together with the vendor community.

106
00:12:28,920 --> 00:12:30,640
And it's been a journey.

107
00:12:30,740 --> 00:12:34,140
You talk about the journey from the aviation village to the aerospace village.

108
00:12:34,140 --> 00:12:35,460
It's really been a journey.

109
00:12:35,460 --> 00:12:48,980
And I am so incredibly, you know, impressed by a number of the bigger companies out there that, you know, a year and a half ago, weren't particularly interested, for instance, in participating in the village.

110
00:12:48,980 --> 00:12:57,320
But now they're meaningful, full-bore, full-throated supporters and members because they get the kind of force multiplier aspect.

111
00:12:57,320 --> 00:13:00,300
I'd rather have you on my team than working against me.

112
00:13:00,300 --> 00:13:03,080
That sort of mentality has really taken root.

113
00:13:03,080 --> 00:13:07,320
And we're, you know, proud to be a part of that effort to keep driving forward.

114
00:13:07,540 --> 00:13:08,200
No, thanks.

115
00:13:08,200 --> 00:13:14,420
And it's that challenge of trying to make sure the dialogue's there because the perspectives are different.

116
00:13:15,560 --> 00:13:21,760
And it feels like trying to fit a really small Venn diagram together and just getting that common ground in the middle.

117
00:13:23,220 --> 00:13:29,200
But what do you think CISA, I mean, and partnering with us on the villages is great.

118
00:13:29,520 --> 00:13:37,100
But what do you think we, the village and the community, and CISA would want to be doing in the next sort of year?

119
00:13:37,100 --> 00:13:43,620
I mean, how do you think that that can work better across all of those stakeholders?

120
00:13:43,640 --> 00:13:47,460
And also as well, what message would you be giving to industry across that as well?

121
00:13:48,000 --> 00:14:02,540
Yeah, so last year, for instance, we were kind of silent partners, helping, again, facilitate some of the conversations, but not a financial supporter, not a, you know, really staffing supporter.

122
00:14:02,540 --> 00:14:13,160
We had folks there last year in Vegas, this year, much more engaged in the planning, bringing the partners together, working with the information sharing and analysis centers, working with the vendors.

123
00:14:13,160 --> 00:14:33,000
I think going forward, I really want to see, you know, assuming we, and hopefully we get through this, this current pandemic where we can get back together physically, really would love to see more practical environmental environments that we can bring researchers in to take,

124
00:14:33,000 --> 00:14:36,720
you know, start shooting holes in things, figuratively, not literally.

125
00:14:36,840 --> 00:14:52,980
But, you know, we've been working in our industrial control systems initiative to develop environmental laboratories, so our cellar program, where we've got control systems environments that folks can mess around with, that they can either conduct research on,

126
00:14:52,980 --> 00:15:09,180
we can tailor them to specific environments like water, but also I think aviation is a great opportunity going forward where we can continue, you know, it's almost like democratizing security for the control system space and including the aerospace environment.

127
00:15:09,180 --> 00:15:17,660
You know, again, it's just making these partnerships more accessible to everyone and much, much more open.

128
00:15:17,660 --> 00:15:22,660
And again, you know, the concept here really more than anything is let's democratize this.

129
00:15:22,660 --> 00:15:27,540
It does not happen overnight, so we've all got to be patient, keep plucking away.

130
00:15:27,540 --> 00:15:35,020
And yeah, sometimes various parts of the community raise their voice and get a little frustrated with others, but keep working on it.

131
00:15:35,020 --> 00:15:39,660
And the more we work on it, the more trust we'll build and the more we'll be able to do in the out years.

132
00:15:40,860 --> 00:15:44,100
And is this the same journey that you've seen across the other sectors as well?

133
00:15:44,320 --> 00:15:58,140
I mean, from what we're seeing across the research and hack community and the dialogue that we've got with industry and regulators and everybody is that actually, this is a journey that has its ups and downs.

134
00:15:59,180 --> 00:16:06,340
And it's not always an easy path because there are so many different and quite strong perspectives out there.

135
00:16:07,600 --> 00:16:12,460
But it sort of feels like this is a journey that other sectors have gone through as well.

136
00:16:13,080 --> 00:16:13,980
Yeah, absolutely.

137
00:16:13,980 --> 00:16:16,840
And again, I'll make second elections.

138
00:16:16,840 --> 00:16:26,920
If somebody's got the Chris Krebs bingo card, if I don't mention election security like six times in any speech, even if it has nothing to do with election security, I've failed.

139
00:16:27,020 --> 00:16:29,380
But election security is a great example.

140
00:16:29,380 --> 00:16:42,020
So in 2016, when it first started becoming apparent what the Russians were trying to do, there wasn't an established, vibrant community of practice in election security.

141
00:16:42,020 --> 00:16:50,880
Yes, there was a security research core team that was looking at these issues, but it hadn't really gone mainstream.

142
00:16:50,880 --> 00:16:53,220
You didn't really have the vendors on board.

143
00:16:53,220 --> 00:16:58,240
You didn't have the operators of the systems, the practical operators of the system.

144
00:16:58,240 --> 00:17:05,860
But over the last three or four years, we really worked hard to bring all those partners together and again, create that vibrant community of practice.

145
00:17:05,860 --> 00:17:14,260
And so as we look into 2020 election, feel much more comfortable, much better about where things are, the security state of various systems.

146
00:17:14,260 --> 00:17:16,120
Are we where we need to go?

147
00:17:16,380 --> 00:17:17,400
Oh, hell no.

148
00:17:17,400 --> 00:17:19,520
I mean, there is still work to be done.

149
00:17:19,520 --> 00:17:20,560
Absolutely.

150
00:17:20,800 --> 00:17:30,600
But by coming together all aspects of the community, we have ensured, or at least we're working towards that additional level of assurance that we're doing the right thing.

151
00:17:30,600 --> 00:17:32,420
We're defending democracy.

152
00:17:32,780 --> 00:17:37,900
And again, the 2020 should be the most secure election in history.

153
00:17:37,900 --> 00:17:39,680
So again, you got to break it down.

154
00:17:39,700 --> 00:17:41,660
Why did we get there?

155
00:17:41,740 --> 00:17:47,980
What led or what contributed to the progress we've made over the last four years?

156
00:17:47,980 --> 00:17:57,560
I kind of, you know, I've stolen this from General Mattis, who I think adapted his leadership style from General Washington, President Washington.

157
00:17:57,560 --> 00:17:59,720
And it's basically four things.

158
00:17:59,780 --> 00:18:02,740
Listen, learn, help, lead.

159
00:18:02,740 --> 00:18:12,780
So we're still, I think, in that learning phase of leadership and understanding the community and transitioning well, I think, into the help space.

160
00:18:12,780 --> 00:18:18,240
But here in the aviation airspace world, there's opportunities for leadership.

161
00:18:18,240 --> 00:18:29,120
And so we're looking at those, seeing what we can do, again, to bring this community together, bring this practical research and sharing of ideas and information.

162
00:18:29,120 --> 00:18:43,080
Last thing I think I'll mention is, you know, I think it goes in just about any other discipline within the security research community is vulnerability coordination.

163
00:18:43,080 --> 00:18:54,500
And how do you do that in a way that gives the defender an opportunity to close out any gaps before the bad guys have proof of concept?

164
00:18:54,800 --> 00:18:56,700
We've seen it in the election space.

165
00:18:56,700 --> 00:18:58,200
We've seen it here.

166
00:18:58,820 --> 00:19:10,120
You know, there are opportunities to help the defender before advantaging the offensive security side of the offense, the threat actor.

167
00:19:10,120 --> 00:19:22,220
So to the extent that we can continue to build those partnerships between the security research community and the vendors, I think we're going to, again, we're going to continue advancing towards a defensive advantage position.

168
00:19:23,040 --> 00:19:23,660
Thanks.

169
00:19:23,660 --> 00:19:26,680
And that touches on so many different areas.

170
00:19:26,940 --> 00:19:41,440
I think one of the things that you've been talking about there from the democratization of it, from the amount of research and hackers that we've got contributing to the village through either breakers yards or buying stuff off the internet and things like that.

171
00:19:41,440 --> 00:19:45,160
And actually, they're doing some really great research on what they're finding.

172
00:19:45,580 --> 00:19:50,960
And it's trying to make sure that those pathways exist to be able to talk about some of those findings and go through it.

173
00:19:51,580 --> 00:20:00,120
Because that then sparks a dialogue that actually allows engagement to happen and actually that progress to be made.

174
00:20:00,120 --> 00:20:03,240
So yeah, there's loads of lessons across all of that.

175
00:20:03,240 --> 00:20:12,300
To be perfectly clear here, I'm not casting any aspersions or judgment on any part of the community right now.

176
00:20:12,540 --> 00:20:21,600
Whether you're on the vendor side of the security research community, I think everybody's got... you talk about ups and downs.

177
00:20:21,840 --> 00:20:28,780
Everybody, I think, has made some good strides forward over the last couple of years and we want to continue making those.

178
00:20:28,780 --> 00:20:30,800
But it's got to be an open conversation.

179
00:20:31,100 --> 00:20:33,980
It's got to be forward-thinking and progressive.

180
00:20:34,140 --> 00:20:39,380
That's the only way we're going to get where we need to be.

181
00:20:40,200 --> 00:20:43,140
Yeah, and actually... and look at the scale of the challenge.

182
00:20:43,700 --> 00:20:49,260
I mean, you touched upon the elections on... if you just sort of sat back and said, let's just protect the elections.

183
00:20:49,260 --> 00:20:50,720
I mean, that's a massive task.

184
00:20:50,720 --> 00:21:04,980
If we look across the aerospace sector, with everything from airports, the air traffic management aspects, the aircraft, and then space, be that ground stations or all the on-orbit assets, the scale of that is huge.

185
00:21:04,980 --> 00:21:08,400
And it's a massively interdependent sector as well.

186
00:21:09,240 --> 00:21:17,940
How do we scale this, from your perspective, looking at this nationally and also internationally, with all of the international work you and the team are involved in?

187
00:21:17,940 --> 00:21:22,840
But how do we make sure that we do this in lily pads of excellence?

188
00:21:23,220 --> 00:21:26,940
I think that's exactly what we've been doing over the last couple years.

189
00:21:26,940 --> 00:21:31,920
Everybody's got their normal partners that they work with.

190
00:21:31,920 --> 00:21:35,180
And that really became clear to me last year.

191
00:21:35,180 --> 00:21:52,060
We were going through a process, working with the Department of Commerce, trying to understand across the telecommunications sector, the ICT folks, where really the most risk lies in terms of supply chain vulnerabilities.

192
00:21:52,060 --> 00:21:54,800
Not vulnerabilities, but risks, really, more than anything.

193
00:21:54,860 --> 00:22:03,280
And what we found is we didn't have a really strong relationship with the satellite communities in the industry.

194
00:22:03,340 --> 00:22:08,940
And it was an area that I think they realized as well, that they didn't really know what we were doing, what our role was.

195
00:22:08,940 --> 00:22:23,440
So to get to those elements of scale, I think it's got to be these broader conversations, talking both within government, but also within industry, and understanding what the respective lanes in the road are.

196
00:22:24,060 --> 00:22:34,680
And, you know, something I've said a couple times now, but, you know, you really, you know, it goes back to that, the mantra of, you know, to improve something, you've got to be able to measure it.

197
00:22:34,700 --> 00:22:41,820
Well, to really scope the problem, you have to understand who the players are, and what their roles are, and how we can all work together.

198
00:22:41,820 --> 00:22:48,560
So that's what we've really been focusing on, in part through an effort that we have called the National Critical Function.

199
00:22:48,560 --> 00:23:06,380
So it's moving away from a 16 sector based understanding of US critical infrastructure, but instead distilling it down to what are the actual services, what are the functions, really a systemic risk approach to the economy, and then identifying who the key providers of services are.

200
00:23:06,380 --> 00:23:15,720
And in doing so, we'll get that better understanding of risk, better partnerships built, and then better solutions against the risks that we need to manage.

201
00:23:16,100 --> 00:23:29,820
And against those risks, would you be expecting those critical service providers to be working with the research community and actively engaging with that community as well?

202
00:23:30,700 --> 00:23:38,400
I, yeah, I mean, look, this is, part of our force multiplier here as defenders.

203
00:23:38,760 --> 00:23:44,280
The security research community has proven time and time again, that it can help.

204
00:23:44,460 --> 00:23:51,820
I am, you know, I'm in a similar situation, honestly, to the security research community, in a lot of respects.

205
00:23:51,820 --> 00:23:57,180
All the things we do here at CISA tend to be voluntary, public private partnerships.

206
00:23:57,180 --> 00:24:01,640
And the security research community working with is similar, it's a partnership.

207
00:24:01,700 --> 00:24:13,080
So you do that by building trust, by understanding what the kind of the needs are, and then putting up a capability or putting a resource or service against that need.

208
00:24:13,140 --> 00:24:15,100
And both sides benefit.

209
00:24:15,100 --> 00:24:16,560
That's how we operate.

210
00:24:16,560 --> 00:24:26,100
And I think that's again, going forward, that's that culture, that community, that we really look forward to being a part of, but also fostering.

211
00:24:26,560 --> 00:24:27,280
No, thanks.

212
00:24:27,280 --> 00:24:40,120
And I think that everyone's actually, I mean, the momentum that we're building up on all of the dialogue across the aerospace, security research and hack community is building in a really nice way.

213
00:24:40,120 --> 00:24:42,880
And actually, the engagement we've got from the vendors is great as well.

214
00:24:42,880 --> 00:24:51,440
And I think it's from dialogues such as that from yourselves, and the other industry leads really, is making a huge difference.

215
00:24:52,420 --> 00:25:14,020
And when we're talking about sort of all of the challenges and the scale of it, how do we try to sort of not see that necessarily through a work, partly through a workforce lens, but there's a lot of organizations now that are really throwing a lot of effort now on to securing or putting more bandwidth on their security.

216
00:25:14,060 --> 00:25:24,100
Therefore, how do we spin up the workforce on this from a national perspective, because getting that getting that crossover between aerospace and cyber security and security is really hard.

217
00:25:24,100 --> 00:25:27,160
Getting those people that can understand both worlds is a challenge.

218
00:25:27,260 --> 00:25:28,020
Right.

219
00:25:28,440 --> 00:25:43,440
You know, I think the ongoing conversations about the gap in cybersecurity workforce is ultimately a little bit, it's almost nihilistic, right?

220
00:25:43,440 --> 00:25:48,380
It's like, we're always going to fail in secure code and secure deployment.

221
00:25:48,380 --> 00:25:50,760
And I think you've already touched on it a little bit.

222
00:25:50,760 --> 00:26:06,340
But, you know, I think the more opportunities for STEM, steam, or whatever you want to call it, at the K through 12 level is going to generate a workforce that's more technically savvy.

223
00:26:06,340 --> 00:26:25,140
And if we can start folding in rather than bolting cybersecurity expertise on to the after the fact and start building it in whether it's DevSecOps or a security development or software development life cycle, those sorts of approaches, I think, are what we're going to have to adapt.

224
00:26:25,140 --> 00:26:28,520
So it's not about building a cybersecurity workforce in the future.

225
00:26:28,640 --> 00:26:34,740
It's a security minded engineering and technical workforce to the future.

226
00:26:34,960 --> 00:26:37,840
Let's close out these issues before we even get to them.

227
00:26:37,840 --> 00:26:42,560
And that's really kind of the mantra that we've got here at the agency.

228
00:26:42,560 --> 00:26:45,320
It's defend today, secure tomorrow.

229
00:26:45,320 --> 00:26:46,100
What does that mean?

230
00:26:46,100 --> 00:26:53,620
So today, we're dealing with patching yesterday's vaults, the stuff that, you know, whatever company dropped.

231
00:26:53,620 --> 00:27:04,580
Let's learn from all these examples and figure out how for the next generation, the next iteration of infrastructure deployments, we just don't make things better by design, better by deployment.

232
00:27:04,580 --> 00:27:06,280
Let's make our lives a little bit easier.

233
00:27:06,280 --> 00:27:09,140
And I frankly, it'd be great if we could put ourselves out of business.

234
00:27:09,140 --> 00:27:10,460
That's never going to happen.

235
00:27:10,460 --> 00:27:13,540
But it's not a bad thing to shoot for.

236
00:27:14,380 --> 00:27:20,820
So I tell you what, this is an issue, workforce, education, that's personal to me.

237
00:27:20,820 --> 00:27:26,040
I have five kids here in DC that are in the public education system.

238
00:27:26,040 --> 00:27:34,660
And I just see day in, day out, the kind of dearth of, as I see it, appropriate technical education.

239
00:27:35,060 --> 00:27:36,600
We've got to overcome that.

240
00:27:36,600 --> 00:27:46,460
So there are a number of initiatives that we're working here at CISA that are intended and designed to, again, overcome those shortfalls.

241
00:27:46,460 --> 00:27:49,720
And it's not going to be about universities.

242
00:27:49,720 --> 00:27:51,480
It's not going to be about colleges.

243
00:27:51,480 --> 00:27:53,280
I don't think that's the solution.

244
00:27:53,380 --> 00:28:02,260
I think, again, we've got to have better K-12, have better trade school-type education at institutes.

245
00:28:02,520 --> 00:28:12,600
Again, it's about putting the tools into the hands of the future workforce and not four-year or post-grad programs.

246
00:28:12,700 --> 00:28:21,160
Last thing I'll say on this front is we also need to be smarter about the way that we bring people into the workforce.

247
00:28:21,160 --> 00:28:25,340
And in part, that's through our hiring practices.

248
00:28:25,340 --> 00:28:27,440
It's through how we advertise for jobs.

249
00:28:27,440 --> 00:28:36,120
The Aspen Institute cyber program last summer announced a couple different ways to approach hiring.

250
00:28:36,120 --> 00:28:38,500
One is don't over-spec your PDs.

251
00:28:38,500 --> 00:28:39,420
Don't over-spec them.

252
00:28:39,420 --> 00:28:49,040
Not everybody needs 15 different certifications and 10 years of experience for coding language that's been around for four.

253
00:28:49,340 --> 00:28:51,460
You saw that advert as well, then.

254
00:28:51,620 --> 00:28:52,680
Yeah, I did.

255
00:28:53,000 --> 00:28:54,380
That was a good one.

256
00:28:55,080 --> 00:29:00,480
And then also use un-gendered or gender-neutral terms.

257
00:29:01,480 --> 00:29:03,400
Unconscious bias is a thing.

258
00:29:03,440 --> 00:29:04,800
And how do we get away from that?

259
00:29:04,800 --> 00:29:13,420
How can we have a more diverse and inclusive workforce that diversity and lack thereof in cybersecurity and technical fields is absolutely a thing.

260
00:29:13,420 --> 00:29:20,820
And I think it's on us as leaders and voices in the community to drive for change.

261
00:29:21,840 --> 00:29:24,340
And hopefully that'll be the way as we go forward.

262
00:29:24,340 --> 00:29:31,540
And again, it's something that we're seeing through the village is actually just trying to bring on that next generation to really get engaged on it.

263
00:29:31,540 --> 00:29:51,400
And a lot of the activity that we've got in the villages is that crawl-walk type activity to really have that on ramp for not necessarily any sort of specific demographic, but anybody who wants to get involved and start engaging and learning about this sort of stuff.

264
00:29:53,340 --> 00:29:56,560
It's an open and engaging community, and that's what makes it so great.

265
00:29:56,860 --> 00:30:02,460
So just to kind of rip on this for a second, I think about the way that the federal government here in the U.S.

266
00:30:02,460 --> 00:30:03,360
hires.

267
00:30:03,360 --> 00:30:13,020
And it's a college degree and three years of experience, and you too can qualify for a GS-9 position.

268
00:30:13,480 --> 00:30:31,000
But that sort of experience, I see kids going into college at 18 having six, seven years of coding experience, of in some cases development experience, certainly of research experience.

269
00:30:31,000 --> 00:30:40,280
So how do we bring those types and reward them for their experience and recognize that experience and not just say, oh, you don't have a CISSP, so you're not qualified.

270
00:30:40,340 --> 00:30:44,320
It's absolutely wrongheaded and backwards, but we have to change that.

271
00:30:44,320 --> 00:30:47,660
And so there are a few things, again, that we're doing here in the government.

272
00:30:47,660 --> 00:30:48,840
We're trying to change that.

273
00:30:48,840 --> 00:30:56,880
There's one hiring regime that we're putting the final touches on, the cyber talent management system that'll do just that.

274
00:30:56,880 --> 00:31:08,440
It'll look for experience, practical experience, and reward that through the hiring process, rather than saying you need that four-year degree and you need three years of working in a call center.

275
00:31:08,440 --> 00:31:11,600
So we've got a couple of things I think we can do here.

276
00:31:11,640 --> 00:31:13,640
It's just a matter of implementation.

277
00:31:14,320 --> 00:31:15,920
That sounds really great.

278
00:31:16,120 --> 00:31:31,920
Now, before we move on, is there anything that, from your perspective, we haven't touched upon, but you'd want us to pitch out or engage with on the community around the aerospace cybersecurity?

279
00:31:32,820 --> 00:31:40,940
Well, just to kind of do a self-serving promo here, just on the last piece, we are hiring CISA.

280
00:31:41,200 --> 00:31:45,800
There are a lot of positions that we have that don't require top secret clearances.

281
00:31:46,390 --> 00:31:50,220
Either the secret or the no security clearance level.

282
00:31:50,220 --> 00:31:52,260
I am looking for practitioners.

283
00:31:52,260 --> 00:31:55,700
I'm looking for people that know the community, that can work with the community.

284
00:31:55,700 --> 00:32:05,800
I think we have a unique offering and a unique place within the federal government that's really the closest thing to the private sector, the closest thing to the security research community.

285
00:32:05,800 --> 00:32:09,540
So check us out at cisa.gov slash careers.

286
00:32:09,680 --> 00:32:11,540
We are always hiring.

287
00:32:12,260 --> 00:32:15,760
Okay, well, we don't normally do commercial pitches, but I think I'll let you have that one.

288
00:32:18,680 --> 00:32:20,940
Chris, many thanks for your time.

289
00:32:21,040 --> 00:32:24,800
Thank you for joining us at the kickoff for the Aerospace Village.

290
00:32:24,960 --> 00:32:29,740
And hopefully once we get through COVID, then look forward to seeing you again in person.

291
00:32:29,740 --> 00:32:30,740
Thank you very much.

292
00:32:31,140 --> 00:32:31,940
Hey, thanks, Pete.

293
00:32:31,940 --> 00:32:32,820
It's great to be with you.

294
00:32:32,820 --> 00:32:36,440
If I was on Room Raider, I'd probably give you about a four out of 10.

295
00:32:36,520 --> 00:32:43,120
You'd get probably five or six for all your badges, but your lack of art and any potted plants probably set you back a few.

296
00:32:43,120 --> 00:32:47,480
Yeah, I made sure I kicked the cats out, so I thought I'd get a few extra points.

297
00:32:47,940 --> 00:32:49,300
Thanks very much.

298
00:32:50,780 --> 00:32:53,560
So our next guest speaker is Dr.

299
00:32:53,560 --> 00:32:56,520
Will Roper, and I'm honored to have him here this morning.

300
00:32:56,720 --> 00:32:57,320
So Dr.

301
00:32:57,320 --> 00:32:59,380
Will Roper is the Assistant Secretary of the U.S.

302
00:32:59,380 --> 00:33:02,320
Air Force for Acquisition Technology and Logistics.

303
00:33:03,140 --> 00:33:09,060
And he and his team, along with DDS, were great supporters of the village last year and have been again this year as well.

304
00:33:09,280 --> 00:33:26,840
And as you can see from the efforts that we've got through the HACSAT CTF and also the workshops that they've brought along to the village to support us this year, they've shown a huge amount of passion in the topic, and it's great to have him here.

305
00:33:26,840 --> 00:33:27,620
So, Dr.

306
00:33:27,620 --> 00:33:28,500
Will Roper.

307
00:33:29,640 --> 00:33:36,300
Hello , everyone, and welcome to the Aerospace Village at DEFCON 28, safe mode.

308
00:33:36,300 --> 00:33:44,580
I'm Will Roper, the Head of Air Force and Space Force Programs, and it is a privilege to be at DEFCON for my second year.

309
00:33:44,700 --> 00:33:56,820
Last year, I came and was blown away by the technical talent that DEFCON has in this community of creative, inquisitive investigators of all things software-driven.

310
00:33:56,900 --> 00:34:04,840
We brought a live hacking opportunity with one of our F-15 fighters, and yes, this community was able to get in.

311
00:34:04,840 --> 00:34:20,920
We were left with a lot of great understanding about how to be better in the cyber domain, and we're back this year with an amazing opportunity that's going to teach the community and us how to take good cyber practices into space.

312
00:34:21,040 --> 00:34:30,120
Orbiting overhead right now is a satellite that hackers are going to have access to to see if they can apply their skills to get in.

313
00:34:30,120 --> 00:34:41,160
They're going to have to understand complicated physics, how satellites communicate with the ground, and how we communicate back in order to overcome this capture the flag challenge.

314
00:34:41,160 --> 00:34:46,300
But seeing the talent that's here, my money is on that they will succeed.

315
00:34:46,360 --> 00:34:53,400
Now, how cool is that, that winning teams are going to get to have their code run live in space?

316
00:34:53,400 --> 00:35:02,600
And what we'll learn is how to make this new area of defense and commercial innovation more cyber secure in the long run.

317
00:35:02,600 --> 00:35:14,040
You know, if you back up and you look at how the Air Force engaged, we really sat behind our high walls and fence lines, and we used secrecy as a way to keep our military systems safe.

318
00:35:14,040 --> 00:35:16,400
That doesn't make sense in today's world.

319
00:35:16,400 --> 00:35:28,140
With so much technology happening commercially, we've got to get outside of our bases and fence lines and be part of this community that continues to push innovation forward.

320
00:35:28,140 --> 00:35:37,300
So we are here to share, we are here to learn, and to make openness and transparency part of our equation for being secure.

321
00:35:37,320 --> 00:35:40,780
Thank you for being here as part of the Aerospace Village.

322
00:35:40,780 --> 00:35:43,780
Thank you for being here to participate in HackASAT.

323
00:35:43,780 --> 00:35:58,580
And next year, when we're back with the next round of the thing we bring to expose to the community, I hope you'll share your thoughts about what opportunity would inspire you to help us learn how to be a better cyber warrior.

324
00:35:58,580 --> 00:36:08,600
For the 60 billion dollars of airplanes and satellites and cyber technology that we produce each year, the cutting edge comes from software.

325
00:36:08,680 --> 00:36:20,040
Everything we learn about making that cutting edge more secure makes our men and women in uniform, this nation, and our allies and partners and all who work with us safer.

326
00:36:20,040 --> 00:36:24,980
So we are proud to be part of this community and can't wait to see what's ahead.